The cost of expected cybersecurity mandates: bigger energy bills for consumers

The Biden administration’s forthcoming national cybersecurity strategy is widely expected to call on utility operators to invest more on cybersecurity protections to guard against malicious hackers who are increasingly targeting critical infrastructure.

And that will mean consumers will end up footing the bill for those added protections, said Bill Fehrman, CEO of Berkshire Hathaway Energy, at the annual S4x23 ICS conference in Miami on Wednesday.

Fehrman, who is co-chair of the influential Electric Subsector Coordinating Council, said that utilities are investing in more clean energy initiatives and any new mandates to increase digital defenses from the administration will be difficult for power companies to absorb.

His comments at the S4 conference, a gathering of professionals and policymakers focused on the security of industrial systems, comes as the broader cybersecurity industry is awaiting the highly anticipated national cybersecurity strategy from President Biden. According to people who have seen advanced copies of the plan, it is expected to call for cybersecurity regulations for critical infrastructure operators.

The added costs that come with expected cybersecurity regulations will be “above and beyond what those companies are able to absorb and so I think there will be increased costs because of security,” said Fehrman. “But it’s a cost of doing business in the end.”

As more pressure grows on electric utilities to prioritize cybersecurity, that also means shifting away from the common industry practice to buying the lowest cost components, said Fehrman. Instead, he said, utilities should shift to buying the lowest-risk option.

Fehrman did say that overall cybersecurity information sharing between the utility sector and the government is improving, a development he said will help improve the industry’s overall approach to defending against digital threats.

“We’re on the frontlines, we’re gathering all the data. We don’t know what to do with it. We can hand it off right to the intelligence community, they know what to do with it, they can give us immediate feedback,” Fehrman said. “Then we have this sharing and much faster transfer of information so that we can actually put actionable items into into practice.”